The Oracle Java audit in 2026, stage by stage. How the claim is built, and how it shrinks.

An Oracle Java audit runs in five stages, and only the last two look like an audit. In 2026 Oracle is turning unanswered friendly emails into formal GLAS notices, so the stage you are in decides which options you still have.

How does an Oracle Java audit work?

An Oracle Java audit is a commercial process in five stages, and only the last two look like an audit. By the time the first friendly email arrives, Oracle has already scored your account against download logs and support records you never sent, and it has priced the outcome it expects to reach.

The word audit appears only at stage three, when the file passes to GLAS, the audit arm formerly known as LMS. From then on the process runs on the audit clause of your contract.

What decides the size and timing of a Java claim?

The claim turns on one number, your employee count. Since the January 2023 license change, the Java SE Universal Subscription has been priced per employee, with a lower monthly rate for each larger headcount band.

• Installs do not set the price. A company with 200 Java installs can open a letter that prices 12,000 people.
• The opening claim is negotiable. Oracle opens on the full headcount plus arrears, and the claim falls as you replace its assumptions with evidence. The spread between that opening number and a settlement built on evidence is the widest we see in any Oracle practice.
• 2026 is faster. Formal notices are replacing soft outreach on accounts that did not reply, so the soft audit window, where the best settlements close, is getting shorter.

What are the five stages of an Oracle Java audit?

The five stages are signal, soft outreach, formal notice, findings and settlement. Each has a different owner at Oracle, a different pace, and one decision you cannot take back. Most buyers believe they are having a conversation when they are already three quarters of the way through a process Oracle started without them.

Your stage tells you what you still control. At stage two you can still decline to share numbers, choose your own discovery tools and set the pace. By stage four a findings report exists, and your job becomes taking it apart line by line.

Why you almost never enter at stage one

Why are Oracle's soft Java letters turning into formal audits in 2026?

Oracle has run soft outreach for three years and is now escalating the accounts that did not engage. That outreach meant compliance emails, review offers and account team pressure, and it rarely produced a formal letter. Now unanswered outreach is becoming formal notices issued by GLAS, Oracle's rebranded license management function, under the audit clause of the master agreement.

A soft letter is not a contractual event, and nothing in your agreement compels you to answer it. A formal notice triggers the obligations and timelines written into your audit clause, starting with its notice period.

Which agreement gives Oracle the right to audit your Java use?

Settle this before anything else, because the answer is less obvious than it looks. Many Java claims rest on the OTN click through terms rather than the master agreement, and the two carry very different audit rights.

Where an Oracle Master Agreement applies, read its audit wording line by line. Oracle's current online version sets three terms.

• Notice. Oracle may audit on 45 days written notice, no more than once a year.
• Cooperation. You provide reasonable assistance and access to information, including running Oracle data measurement tools on your servers and handing over the results.
• Remedy. You have 30 days from written notification to remedy any non compliance, which can mean buying licenses. If you do not, Oracle can terminate the affected licenses or the agreement itself.

How does Oracle build the dollar figure in a Java claim?

The commercial shape of the claim is standard by now. Oracle prices the full employee count on the Java SE Universal Subscription, then adds back exposure, commonly framed as up to three years of subscription fees for the period of unlicensed use. For a 5,000 employee company that construction alone opens north of $2.5M.

The back claim is the most negotiable line in the whole file. In the settlements we defend it is routinely reduced or waived entirely, which is why a written release of past use belongs in any deal you sign.

How does the employee metric set the size of an Oracle Java audit claim?

The Java SE Universal Subscription counts people, not processors and not installs. It does not matter how many of those people ever touch Java: one qualifying install can price the entire headcount. The bands below are Oracle's list prices.

For most enterprises this is a seven figure line, which is why the current price analysis belongs in front of your CFO before any Oracle call. Oracle's own subscription FAQ adds two details: pricing can go below $5.25 for customers with more than 50,000 employees, and the standard term is one year.

Who counts as an employee under the Java metric?

The definition reaches every full time and part time employee, every temporary worker, and the contractors, agents and consultants who support your internal business operations. Contractor staff are where Oracle's draft and your HR data usually disagree, and our note on contractors and consultants in the employee count works through the common cases.

Which parts of the count can you contest?

Four parts of the count are open to argument, and Oracle's opening letter answers each one in Oracle's favor. A settlement built on evidence answers them on the facts of your organization.

• Entity scope. Which legal entities and regions are in the number, including subsidiaries that run no Oracle Java at all.
• Contractors. Which contractor staff actually support your internal operations, and whether they are counted by head or by full time equivalent.
• Acquisitions and divestitures. Whether a sold unit or a newly acquired company belongs in the count, and from which date. Our guide to divestiture and acquisition headcount covers the timing questions.
• The as of date. The date the headcount is taken and the HR report it comes from.

What should you do in the soft audit window?

Prepare your evidence, answer with process, and keep numbers to yourself. Most settlements that close on good terms for the buyer start in this window.

At stage two the file still belongs to people measured on revenue and relationship, the claim is informal, and no contractual clock is running. Once GLAS signs the notice, the file belongs to people measured on findings.

Which three actions in the soft window cannot be reversed?

They are confirming a number, running Oracle's discovery and self reporting through a portal, and each feels helpful at the time.

• Confirming a headcount on a call. The number you mention becomes the floor of every later conversation. Offer process instead: you are reviewing your Java use and will respond through a defined channel.
• Running Oracle supplied discovery. The Oracle audit scripts collect more than Java, and their output becomes Oracle's evidence. Run your own tooling first, on your own timeline.
• Self reporting through a portal. A portal submission is a signed admission with none of the protections a negotiated settlement carries. Nothing obliges you to use one.

Everything else can be renegotiated, including a soft letter you have already answered badly, but weeks spent without an inventory are gone. The engagements that close fastest and lowest are the ones where the buyer arrives at the first substantive call with a verified inventory and a priced alternative. Our audit defense guide covers the response sequence step by step.

What will Oracle say, and how should you answer?

The same handful of lines comes up in almost every Java file. Each has a purpose, and each has a reply that keeps your options open.

What happens when GLAS issues a formal Java audit notice?

The process switches to the contract. The formal notice cites the audit clause of a named agreement, is addressed to a named executive, and gives the notice period in that clause before fieldwork starts. Data requests, discovery, a findings report and a resolution deadline follow.

Three to six months from formal notice to signature is the normal range in the engagements we support. The ceiling on the settlement is usually set inside the first four weeks, before any script has run. Staff that first month properly: legal, IT asset management, HR for the headcount, and one named person who speaks to Oracle.

What assumptions sit inside the findings report?

Read the findings report as a draft. It combines discovery output with three assumptions: every install is commercial use, every employee is in scope, and the arrears period runs to the maximum. Each can be contested, and reclassifying installs is where most of the exposure disappears.

• Third party redistributions. Java shipped inside another vendor's product is commonly licensed by that vendor. Ask the vendor to confirm it in writing, and see our note on Java in third party appliances and embedded products.
• Free use terms. OpenJDK builds carry no subscription obligation, and development use under the OTN terms is permitted. Oracle JDK builds released under the No Fee Terms and Conditions are free in production: JDK 17 updates through September 2024, JDK 21 updates through September 2026, and JDK 25 updates, planned under those terms until September 2028. Later JDK 17 and 21 updates fall under the OTN license.
• Removable leftovers. Old JDKs on decommissioned servers and forgotten developer installs count in discovery and disappear under remediation.

How do you check your own Java installs before Oracle does?

Use your own tools and keep the output inside your network until you have reviewed it. For every install you need the host, the version, the vendor build, the application it serves and the license terms that apply.

1. Software inventory. Query Microsoft Configuration Manager, Intune or your asset management tool for anything named Java or JDK. Then scan file systems for java and java.exe binaries, because bundled runtimes rarely register as installed programs.
2. Version and vendor. Run java -version against each binary. Oracle JDK prints "Java(TM) SE Runtime Environment", while OpenJDK builds such as Temurin or Corretto print "OpenJDK Runtime Environment". Our guide to telling Oracle JDK from OpenJDK covers the edge cases.
3. Linux packages. List installed packages with rpm or dpkg and separate Oracle JDK packages from the distribution's own OpenJDK packages.
4. Containers. Scan your registries and base images. An Oracle JDK baked into one image runs everywhere that image runs.
5. Download history. Reconstruct who downloaded Oracle Java from your network, because that is the record Oracle holds. See what to reconstruct from your download history.

A worked example: 200 installs at a 5,000 employee company

Say discovery at a 5,000 employee company flags 200 Java installs, and Oracle opens at the $2.52M built in the earlier table. A reclassification pass might sort the installs as follows. The split is hypothetical.

Removing 170 of 200 installs leaves the forward price where it was. The metric counts people, so the remaining 30 installs still price all 5,000 employees at $630K per year. What changes is the decision in front of you: subscribe for 5,000 people, or migrate 30 installs to an OpenJDK build and carry no forward subscription.

The back claim changes too. You can now argue arrears from 30 production installs and the dates they actually ran, instead of every machine discovery found. That record, plus the cost of migrating those 30 installs to OpenJDK, is what you take into the commercial discussion.

Oracle negotiates against your evidence only when you have some. Until then, it negotiates against your employee count.

What have we seen in Oracle Java audits from 2024 to 2026?

Between 2024 and 2026 we ran or advised 40 to 60 Oracle Java licensing engagements, and roughly 30 to 40 of them involved a live Oracle approach. The sequence was more standardized than in any other Oracle practice we work in. Three patterns held across nearly every file.

• Opening claim and settlement. Oracle opened on the full employee count and settled 5 to 15 times lower once the buyer's Java use was backed by evidence.
• Inventory before negotiation. A verified inventory removed 60 to 90 percent of claimed exposure before the commercial conversation started, mostly through the three reclassifications described above.
• A costed alternative. Buyers who had priced an OpenJDK migration before the first Oracle call closed faster and lower than buyers who only argued about the count. The subscription was competing with a costed exit.

In one retail engagement, a clean inventory and a credible migration path closed a global Java audit at zero cost. The files that went badly had one thing in common. Every engagement that settled near Oracle's opening number shared at least one of the three irreversible actions from the soft window, taken before advisors were involved.

Why we advise against uninstalling Oracle Java the day the letter arrives

The common reaction to a Java letter is to rip Oracle Java out at once, and we think that is the wrong first step. The audit covers past use, so removal does not erase claimed arrears. A rushed removal also leaves no record of what ran where and when it stopped, and it breaks applications tied to a specific runtime.

The better order is inventory, classify, then remove, with each removal logged by host, version and date. That log is what shortens the arrears period in the negotiation. Our standards for a removal and decommission log set out what each entry should record.

What should an Oracle Java audit settlement include?

If a subscription is the outcome, negotiate the scope of the deal as hard as the rate. A settlement that fixes the price but leaves the employee definition, the entities and the back claims open invites the next audit. Ask for these terms in the order document.

• A written release of past use. A waiver of back claims for all entities up to the effective date, so the arrears line cannot return at renewal.
• A fixed employee count with its source. The number, the as of date and the HR report behind it, so the renewal starts from an agreed figure. See our note on contract language that caps the headcount.
• Named entity scope. The legal entities covered, and how acquisitions and divestitures during the term are treated.
• A contractor definition. Which contractor staff count, written into the order so the question is not reopened every year.
• Term and renewal price. The standard term is one year. If you plan to stay, ask for a multiyear price hold or a cap on renewal increases.
• Audit closure. A letter confirming the audit is closed with no further findings for the period reviewed.

Before you choose a structure, compare the options side by side in our review of Java settlement structures.

Questions to ask Oracle before you sign

1. Which agreement and clause is the claim made under, and which terms applied in each year of the claimed arrears?
2. Which price basis applies to any period before January 2023, when the employee metric did not yet exist?
3. Which legal entities, headcount source and as of date does the number assume, and how are contractor staff counted?
4. What is the renewal price after the first year, and is it capped?

What to do next

1. Acknowledge the process and concede nothing. Answer any letter within its window through one named channel. Give no headcounts and no install counts on any call.
2. Run your own inventory first. Find every Java install with your own tooling, recording version, vendor build, use and the license terms that apply. Everything later stands on this evidence.
3. Reclassify before you count. Take third party redistributions, free use installs and removable leftovers out of scope, and log every removal with its date.
4. Price the exit. Cost an OpenJDK migration for what remains, even if you never run it. Our Java licensing pillar covers the migration decision in depth.
5. Negotiate scope along with price. If you subscribe, settle the employee definition, the entity scope, the term and a written waiver of back claims as well as the rate. Our Java audit defense service runs this sequence with you, on your side of the table.

Frequently asked questions